This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why does wireshark log file saved as a K12 text file shows different time of capture compared to wireshark tool

0

Hi, I am creating a standalone application that processes wireshark text files. The issue that I am facing is that when I save the wireshark capture as a K12 text file and open it in an editor the time of capture it shows above the packet is different from the time of capture if I open the same text file in wireshark tool. Please let me know what could be done in this regards.

Thanks.

asked 16 Aug '16, 06:52

shobhit_garg91's gravatar image

shobhit_garg91
169914
accept rate: 0%

What is the difference in the timestamps? Is it the same as your timezone difference from UTC?

(16 Aug '16, 07:15) grahamb ♦

Hi, I am in ET so the time difference is 4 hours. In case of wireshark though, the time difference is 5 hours. Thanks.

(16 Aug '16, 12:46) shobhit_garg91

It is summer, so some mishandling of DST is likely somehow responsible for the remaining hour.

When you capture, Wireshark timestamps the frames using UTC, but using View->Time Display Format, you may choose whether you want to have the timestamps displayed in UTC or in local time of the machine where you view the capture.

If you save a capture file as K12 text, the timestamps are in UTC, like in the original capture.

So try to change the display mode in Wireshark from local time to UTC and check whether the timestamps shown in Wireshark change by 5 hours as well. If yes, it is enough to explain why the DST is not taken into account, which may be related to your operating system settings.

(16 Aug '16, 13:08) sindy

Hi Sindy, Thanks for your inputs. I checked the time in wireshark by converting it to UTC format. The time gap is now reduced by 4 hours, but there is still a difference of 1 hour between my wireshark capture and the equivalent capture saved in K-12 format.

Thanks.

(16 Aug '16, 13:19) shobhit_garg91

in that case:

  • what is your Wireshark version?
  • on which OS you are running it?
  • in what format is the original capture file you open?
  • where was the original file captured (what OS, which version of Wireshark or other capturing software)?
(16 Aug '16, 13:29) sindy

Hi Sindy, My wireshark version is: 2.0.4 my OS version is: Windows 7 my original capture format is: PCAPNG the original file was captured in the same environment.

Thanks.

(16 Aug '16, 13:44) shobhit_garg91
showing 5 of 6 show 1 more comments